Hi Team

When I install the emqtt debian package in an Ubuntu 14.04 machine, the emqttd service runs as root. This raises some security concerns over the usage of debian package. As mentioned in the startup (init.d) script the emqtt deamon should run as emqtt user which was created for running emqtt. Please have a look.
start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --user emqtt --exec $ERTS_PATH/run_erl

Also the .erlang.cookie file has only root access permission. Is that intended behavior?

Hi
I noticed that emqx-rel repo now has support for building packages.
Perhaps it's time to mark this repo deprecated ?
or if this has to be kept for old versions, we can at least add a link pointing to the right place for newer versions?

Distributor ID: Ubuntu
Description: Ubuntu 16.04.3 LTS
Release: 16.04
Codename: xenial

with emqttd-ubuntu16.04-v2.3-beta.3_amd64.deb

command

$ sudo service emqttd start

result:

*nothing*

except:

 emqttd 2.3 is started successfully!

How to reproduce (case A)
1- install new ubuntu instance
2- cd /tmp
3- wget "http://emqtt.io/static/brokers/emqttd-ubuntu16.04-v2.3-beta.3_amd64.deb"
4- sudo dpkg -i emqttd-ubuntu16.04-v2.3-beta.3_amd64.deb
5- sudo service emqttd start

but work fine if step 5 is (case B)

$ sudo /etc/init.d/emqttd start
emqttd 2.3 is started successfully!

Differance is .erlang.cookie in /var/lib/emqttd/
In case A, file owner and group is root
In case B, file owner and group is emqtt

Trace in case A (fail)

=ERROR REPORT==== 30-Aug-2017::14:44:21 ===
Error when reading /var/lib/emqttd/.erlang.cookie: eaccesescript: exception error: no match of right hand side value
                {error,
                    {{shutdown,
                          {failed_to_start_child,auth,
                              {"Error when reading /var/lib/emqttd/.erlang.cookie: eacces",
                              [{auth,init_cookie,0,
                                    [{file,"auth.erl"},{line,286}]},
                                {auth,init,1,[{file,"auth.erl"},{line,140}]},
                                {gen_server,init_it,2,
                                    [{file,"gen_server.erl"},{line,365}]},
                                {gen_server,init_it,6,
                                    [{file,"gen_server.erl"},{line,333}]},
                                {proc_lib,init_p_do_apply,3,
                                    [{file,"proc_lib.erl"},{line,247}]}]}}},
                      {child,undefined,net_sup_dynamic,
                          {erl_distribution,start_link,
                              [['\''[email protected]'\'',longnames],false]},
                          permanent,1000,supervisor,
                          [erl_distribution]}}}
  in function  nodetool__escript__1504__104260__641513__2:process_args/3 (/usr/lib/emqttd/bin/nodetool, line 137)
  in call from nodetool__escript__1504__104260__641513__2:main/1 (/usr/lib/emqttd/bin/nodetool, line 14)
  in call from escript:run/2 (escript.erl, line 759)
  in call from escript:start/1 (escript.erl, line 277)
  in call from init:start_em/1
  in call from init:do_boot/3 '

It seems like this package is very close to being out-of-the-box buildable on things like Raspberry Pi, which would make for a compelling quick-setup portable MQTT broker use case for EMQ.

I have been testing this out on a few systems, and I was able to successfully prepare the .DEB and manually dpkg -i the result. It installs properly and works great on Raspberry Pi 3 ARMHF.

However, the debian Makefile is currently assuming AMD64, so it fails during copying of the package:
https://github.com/emqtt/emq-package/blob/07bc81e17d4f0751d9993311a2390348831c9121/deb/Makefile#L11

Even if the ARM packages never make it into the official repositories, being able to kick off an emq-package build on a Pi and then DPKG it would make for a very trivial setup on new systems.

Ideally the quick start instructions for Raspberry Pi / ARM would be:

git clone https://github.com/emqtt/emq-package.git
cd emq-package && make
sudo dpkg -i ./package/emqttd_2.3_armhf.deb

I have tested the scenario above (manually) and it worked out great for my devices.

Is this something the team would be willing to explore?